{"id":53580,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd"},"modified":"2021-02-01T11:40:32","modified_gmt":"2021-02-01T09:40:32","slug":"uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","title":{"rendered":"OpenBSD haavatavused, mis v\u00f5imaldavad privileegide t\u00f5stmist ja autentimise \u00fcmbersuunamist smtpd, ldapd ja radiusd teenustes.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Qualys ettev\u00f5te <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.qualys.com\/laws-of-vulnerabilities\/2019\/12\/04\/openbsd-multiple-authentication-vulnerabilities\">tuvas<\/a><\/noindex> neli <noindex><a rel=\"nofollow\" href=\"https:\/\/www.qualys.com\/2019\/12\/04\/cve-2019-19521\/authentication-vulnerabilities-openbsd.txt\">haavatavusest<\/a><\/noindex> OpenBSD-s, kus \u00fcks v\u00f5imaldab kaug\u00fchendust luua m\u00f5nele v\u00f5rguteenusele ilma autentimiseta, ning kolm muud t\u00f5sta s\u00fcsteemis oma \u00f5igusi. Qualyse aruandes m\u00e4rgitakse OpenBSD arendajate kiiret reageerimist - k\u00f5ik probleemid on <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openbsd.org\/errata66.html\">likvideeritud<\/a><\/noindex> \u00fches <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openbsd.org\/errata65.html\">OpenBSD 6.5<\/a><\/noindex> ja <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openbsd.org\/errata66.html\">OpenBSD 6.6<\/a><\/noindex> lahendatud 40 tunni jooksul p\u00e4rast era teavitamist.<\/p>\n<p>Kaugelt \u00e4rakasutatav haavatavus on p\u00f5hjustatud viga autentimise t\u00f6\u00f6tleva teenuse korraldamisel libc teegis, mis kutsub esile<br \/>\nprogrammi \/usr\/libexec\/auth\/login_style koos k\u00e4surea argumentidega. Sealhulgas login_style'i kutsumisel valikulise parameetri \u2018-s service\u2019 abil on lubatud protokolli nime edastamine. Kui kasutajanime alguses kasutatakse s\u00fcmbolit \u2018-\u2019, t\u00f6\u00f6deldakse see nimi login_style'i k\u00e4ivitamisel valikuna. Seet\u00f5ttu, kui autentimise k\u00e4igus m\u00e4\u00e4rata kasutajanimeks \u2018-schallenge\u2019 v\u00f5i \u2018-schallenge:passwd\u2019, t\u00f5lgendab login_style p\u00e4ringut k\u00e4sitlejana <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/S\/Key\">S\/Kl\u00f5ige<\/a><\/noindex>.<\/p>\n<p>Probleem seisneb selles, et S\/Key protokolli tugi login_style'is on vaid formaalne ja seda ignoreeritakse tegelikult, esitades eduka autentimise m\u00e4rgi. Seega v\u00f5ib r\u00fcndaja, esinedes kasutajana \u2018-schallenge\u2019, autentimise \u00fcmber minna ja p\u00e4\u00e4seda juurde ilma parooli v\u00f5i v\u00f5tmete esitamiseta. K\u00f5ik v\u00f5rgu teenused, mis kasutavad autentimiseks libc standardk\u00f5nesid, on potentsiaalselt haavatavad. N\u00e4iteks on suudlus autentimise vahelej\u00e4tmise kinnitamiseks t\u00f5endatud smtpd (AUTH PLAIN), ldapd ja radiusd puhul.<\/p>\n<p>sshd-s ei avaldu haavatavus, kuna seal on t\u00e4iendav kaitse, mis kontrollib, kas kasutaja on s\u00fcsteemis. Siiski saab sshd-d kasutada s\u00fcsteemi haavatavuse kontrollimise jaoks - kui \u00fchendust luua kasutajanimega \u2018-sresponse:passwd\u2019, hangub \u00fchendus, kuna sshd ootab login_passwd'iltagastatavaid kutseparameetreid (challenge), samas kui login_passwd ootab puuduvate parameetrite edastamist (nimi \u2018-sresponse\u2019 t\u00f5lgendatakse valikuna). Potentsiaalne kohalik r\u00fcndaja v\u00f5ib proovida autentimist utiliidiga su m\u00f6\u00f6da minna, kuid nime \u2018-sresponse\u2019 edastamine viib protsessi kokkuvarisemiseni, kuna getpwnam_r('schallenge', ...) funktsioon tagastab nullviit.<\/p>\n<p>Teised haavatavused:<\/p>\n<ul>\n<li class=\"l\">  CVE-2019-19520 - kohaliku \u00f5iguste t\u00f5stmise oht, mis tuleneb xlock utiliidi manipuleerimisest, mis tarnitakse sgid lipuga, muutes grupiks \u2018auth\u2019. xlocki koodis keelatakse teede \u00fcle kirjutamine vaid kasutaja identifikaatori muutmise (setuid) korral, mis v\u00f5imaldab r\u00fcndajal muuta keskkonnamuutujat \u2018LIBGL_DRIVERS_PATH\u2019 ja korraldada enda jagatud teegi laadimist, mille kood t\u00e4idetakse p\u00e4rast \u00f5iguste t\u00f5stmist gruppi \u2018auth\u2019.<\/li>\n<li class=\"l\"> CVE-2019-19522 - kohaliku kasutaja, kes kuulub gruppi \u2018auth\u2019, v\u00f5imaldab root \u00f5igustega koodi k\u00e4ivitamist, kui s\u00fcsteemis on aktiveeritud S\/Key v\u00f5i YubiKey autentimine (vaikimisi on need mitteaktiivsed). Kuuludes gruppi \u2018auth\u2019, millele p\u00e4\u00e4seb ligi xlock'i eeltoodud haavatavust \u00e4ra kasutades, saab kirjutada faile kataloogidesse \/etc\/skey ja \/var\/db\/yubikey. N\u00e4iteks v\u00f5ib r\u00fcndaja lisada uue faili \/etc\/skey\/root, et genereerida \u00fchekordseid v\u00f5tmeid root kasutaja autentimiseks S\/Key kaudu.<\/li>\n<li class=\"l\"> CVE-2019-19519 - ressursipiirangute t\u00f5stmise v\u00f5imalus su utiliidi manipuleerimise kaudu. Kui m\u00e4\u00e4rata valik \u2018-L\u2019, mis eeldab autentimise \u00fcmber proovimist eba\u00f5nnestumise korral, seatakse kasutajaklass vaid \u00fcks kord ja ei l\u00e4htestata j\u00e4rgmiste katsete korral. R\u00fcndaja v\u00f5ib teha \u2018su -l -L\u2019 ja sisestada esimesel katsel vale sisselogimise muu kasutajaklassiga, kuid teisel katsel edukalt autentida end oma nime all. Sel juhul kehtestatakse kasutajale need piirangud, mis vastavad kasutajaklassile, mis m\u00e4\u00e4rati esimesel katsel (n\u00e4iteks maksimaalne protsesside arv v\u00f5i m\u00e4lum\u00f5\u00f5tme piirang protsessi jaoks). Meetod t\u00f6\u00f6tab ainult privileegideta kasutajatelt piirangute laenamiseks, kuna root kasutaja vajab wheel grupis olemist.<\/li>\n<\/ul>\n<p>Lisaks saab m\u00e4rkida <noindex><a rel=\"nofollow\" href=\"http:\/\/undeadly.org\/cgi?action=article;sid=20191202105849\">rakendamise<\/a><\/noindex> OpenBSD-s on uus meetod s\u00fcsteemikutsungite ligip\u00e4\u00e4sukontrolli kontrollimiseks, mis keerulisemaks muudab haavatavuste \u00e4ra kasutamise. Meetod lubab s\u00fcsteemikutsungeid t\u00e4ita ainult siis, kui neid kutsutakse eelnevalt registreeritud m\u00e4lupiirkondadest. M\u00e4lupiirkondade m\u00e4rgistamiseks <noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=openbsd-cvs&amp;m=157500930922882&amp;w=2\">pakutud<\/a><\/noindex> uus s\u00fcsteemik\u00f5ne <noindex><a rel=\"nofollow\" href=\"https:\/\/man.openbsd.org\/msyscall\">msyscall()<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51979\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c, \u0430 \u0442\u0440\u0438 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0412 \u043e\u0442\u0447\u0451\u0442\u0435 Qualys \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u0430 \u0431\u044b\u0441\u0442\u0440\u0430\u044f \u0440\u0435\u0430\u043a\u0446\u0438\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 OpenBSD &#8212; \u0432\u0441\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0431\u044b\u043b\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 OpenBSD 6.5 \u0438 OpenBSD 6.6 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 40 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0433\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f. \u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53580","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432 smtpd, ldapd \u0438 radiusd | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-04T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-02-01T09:40:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenBSD haavatavused, mis v\u00f5imaldavad t\u00f5sta privileege ja ringitada autentimist smtpd, ldapd ja radiusd | ProHoster","description":"Ettev\u00f5te Qualys tuvastas neli","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432 smtpd, ldapd \u0438 radiusd | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2021-02-01T09:40:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53580","title":null,"description":"","keywords":"","keyphrases":null,"primary_term":null,"canonical_url":"","og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 07:57:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:50","updated":"2026-01-24 07:57:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=53580"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53580\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=53580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=53580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=53580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}